App only authentication - oAuth2 token request

Hi ricus_zero 

Am I correct in saying that it's possible for a normal license to create new workspaces via the service principle? (API call)

Yes you are correct 

You shouldn't use get dashboard API using SPN token Instead use get dashboard in group

Now a seemingly simple question of, how do I actually use this embed token in our web app to display the embedded dashboard?

You can use SDK's See App owns data in dotnet

Basically you need to pass the embed token to PowerBI Javascript

<script>
    // Read embed application token from Model
    var accessToken = "@Model.EmbedToken.Token";
    // Read embed URL from Model
    var embedUrl = "@Html.Raw(Model.EmbedUrl)";
    // Read dashboard Id from Model
    var embedDashboardId = "@Model.Id";
    // Get models. models contains enums that can be used.
    var models = window['powerbi-client'].models;
    // Embed configuration used to describe the what and how to embed.
    // This object is used when calling powerbi.embed.
    // This also includes settings and options such as filters.
    // You can find more information at https://github.com/Microsoft/PowerBI-JavaScript/wiki/Embed-Configuration-Details.
    var config = {
        type: 'dashboard',
        tokenType: models.TokenType.Embed,
        accessToken: accessToken,
        embedUrl: embedUrl,
        id: embedDashboardId
    };
    // Get a reference to the embedded dashboard HTML element
    var dashboardContainer = $('#dashboardContainer')[0];
    // Embed the dashboard and display it within the div container.
    var dashboard = powerbi.embed(dashboardContainer, config);
</script>

BTW you can give Like/give kudo's to my replies if you find it useful, by this way it will help others.